1. Fraud, Disputes & Employee Abuse Toinette Miller, Vice President November 1-3, 2006 2006 State of Texas Credit Card User’s Conference

2. 2 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Session Objectives  Define Fraud, Disputes & Employee Abuse  Review trends and impact to the State of Texas program in these areas  Provide techniques and strategies to mitigate loss in these areas

3. 3 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Session Agenda  Define and clarify key terms  Review trends and how to mitigate risk in the areas of  Fraud  Disputes  Employee Abuse  When you uncover fraud/employee abuse within your program  Question & Answer

4. 4 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Definitions  Fraud Unauthorized use of a payment card resulting from a lost, stolen or compromised account. The user has malicious intent and is seeking personal gain from use of an account.  Dispute Authorized cardholder questions the validity of a transaction. More along the lines of a transaction that was “mistakenly” applied to an account. MasterCard defines valid dispute reasons.  Employee Abuse Authorized cardholder uses card in a manner in which the State receives no benefit. MasterCard defines the type of employee abuse for which customers can be indemnified.

5. Fraud 2006 State of Texas Credit Card User’s Conference

6. 6 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Industry Fraud Trends-All Card Types U.S. Lost Acct Takeover Fraud Apps Counterfeit Stolen Card Not Present 2005 Counterfeit Fraud increased in 2005; Issuer has no chargeback rights resulting in higher net losses.

7. 7 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. State of Texas: Fraud Trends & Implications  Consistent with the industry trend, fraud losses for the State of Texas have increased year- over-year.  However, The State of Texas Fraud percentage to spend volume averages.0046% which indicates “Excellent” program controls.  Fraud losses are deducted from the JPMC rebate paid to the State of Texas General Revenue Fund.

8. 8 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. JPMC Response to Changing Fraud Landscape  Increased Staffing Added Analytics unit to our Detection & Recovery team oAnalytics is KEY to our strategy and focuses on Forecasting, measuring JPMC vs. Industry Fraud Trends, implementing Authorization Strategy or Detection adjustments to immediately react to changing trends. Enhanced Prevention Strategies More aggressive blocking of accounts to minimize loss per case oBlock and Call vs. Call and Block – Paradigm Shift oDuring a face-to-face transaction, the merchant will a “call for authorization” message oNon face-to-face such as auto gas pump, mail, telephone, internet, could be declined. Work queues in CardGuard daily to identify suspicious activity oWe place a temporary hold and call on a PERCENTAGE of transactions in queue based on further review. oYOU still need to monitor your program for potential fraud Implementation of cutting-edge fraud prevention tools oFALCON – February 2006 oScores transactions – high score determines which transactions are high risk for fraud. These transactions added to our strategies in CardGuard.

9. 9 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. JPMC Response to Changing Fraud Landscape  Improved Forecasting Systems CapFRAUD forecasting tool implemented – April 2006 oReview forecast outlook weekly to proactively react to any variances.  Better Use of Program Controls  MCC Controls-Eliminated the use of “99I” MCC group within State of Texas Accounts oIf a State of Texas entity wants very loosely controlled MCCs on a permanent basis, the entity will be required to customize their group. oIf an agency wants a one-time override AND the merchant is not able to call for an authorization, a MCC group called “OVERRIDE” has been established for this purpose oJPMC will occasionally “sweep” any accounts that have the OVERRIDE MCC group and change it back to the original group should the PA forget to do this.

10. 10 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Minimizing Your Entity’s Fraud Risk  Review Your Program Controls!  Not all fraud can be thwarted, but implementing proper controls can significantly reduce your fraud risk. ―Review MCC Assignments: Keep ALL unused, unnecessary MCCs closed ―Review Velocity controls to ensure they are in line with typical usage ―Review and limit Cash access (*Co-OP Only)-only use when absolutely necessary ―CLOSE accounts that are not in use.  Review your Cardholder Training Materials  Ensure your training materials have evolved with your program and have not become outdated  Consider frequent refresher training for existing cardholders beyond the initial training

11. 11 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Minimizing Your Entity’s Fraud Risk  Minimize Use of Department Cards  Fraud is NOT recoverable on Department Cards –this is a MasterCard rule! JPMC cannot initiate a chargeback for Fraud on department cards.  Weigh the risks vs. the benefit of using Department Cards ―Example: When using a CBA, you will need to weigh the fact that a NAMED card offers Travel Accident Insurance for the named cardholder ONLY vs. a CBA Department Card has TAI coverage for all persons ticketed using that card.  Department Cards should be utilized for specific, micro-level strategies and should not be used program-wide  Careful Monitoring  Prompt notification of employee status changes, leaves of absence and cancellations from HR to Program Administrator  Close cards of employees that have separated from the entity

12. 12 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Minimize Your Entity’s Fraud Risk  Careful Monitoring  Review of activity either on-line or paper  Report suspicious activity and charges to JPMC immediately  Monitor High-Risk Exception Processes Closely  Stranded Traveler – monitor frequency and duration of these occurrences  One-Time Override – ―PA requests one-time override; the vendor and amount is notated on the account ―The merchant calls in. ―Customer service changes limits to allow authorized charge to go through and then immediately changes account back to original controls ―However some one-time overrides require that the controls be changed for an extended period of time ―This is typically when the merchant refuses to call in for approval ―In such case, the PA must REMEMBER to change the MCCG to it’s original group right after your cardholder has successfully made the transaction

13. 13 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Minimize Your Entity’s Fraud Risk  When Fraud does occur:  Notify JPMC IMMEDIATELY so that we can minimize risk by closing/blocking the compromised card.  Notify Appropriate Authorities—they may assist in seeking restitution ―Police Department to file a police report ―Office of Attorney General Special Investigations Unit (SIU) ―TXGC 321.022 REQUIRES that state agency employees report incidents occurring at a Texas State Agency or College or University ―Contact SAO SIU unit with fraud cases 3 ways: ―By Phone at 1-800-TX-AUDIT ―On-Line at www.sao.state.tx.uswww.sao.state.tx.us ―Or my mail at: State Auditor’s Office, ATTN: SIU PO Box 12067 Austin, TX 78711

14. 14 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Could this Fraud have been avoided? Fraud Situation #1  Travel CBA Account with 99I MCC controls had several “card not present” fraud purchases from Lowe’s and Home Depot.  Tighter MCC restrictions may have caused a decline on these transactions. Fraud Situation #2  Procurement Card Account never used by the cardholder was stolen by a roommate and used at Wal- Mart and Old Navy over several months.  Better enforcement of cardholder requirement to approve monthly statement in a timely manner would have caused the PA to follow-up on unapproved transactions.  More timely cardholder review would have eliminated the majority of this fraud.  Tighter MCC restrictions on non- traditional vendor types may have caused a decline.

15. Disputes 2006 State of Texas Credit Card User’s Conference

16. 16 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. JPMC Dispute Handling & Guidelines  MasterCard requires that you first attempt to resolve the dispute with the merchant ―Note date and results of your attempt to resolve the dispute  If unsuccessful, call JPMC customer service at 888-508- 9758 or fax a completed dispute form to 888-297-0768 ―Ensure disputes are reported within 60 days of the statement date on which the charge was posted. ―If you were working with a merchant to resolve a dispute but you do not see your credit before the 60 day mark, FILE A DISPUTE so that JPMC has the authority to work on your behalf. ―Dispute forms and procedures posted on TBPC website http://www.tbpc.state.tx.us/ca_page/cat_946_a1_0306.html http://www.tbpc.state.tx.us/ca_page/cat_946_a1_0306.html  Dispute process tightly governed by MasterCard’s rules and guidelines.

17. 17 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. JPMC Dispute Handling & Guidelines  Merchants have 45 days to respond to your dispute claim  Provisional “soft” credit provided during dispute research process  Participating entities are responsible for all disputed transactions resolved in the merchant’s favor  Disputes resolved in the merchant’s favor should be processed and paid through USAS using the Object Code you would normally assign for the specified purchase.

18. 18 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Disputes: Impact to your Bill Disputes Resolved in Merchant’s Favor  Dispute message on statement will say that the dispute has been resolved.  Disputed amount added back to the Amount Due.  Entity responsible for paying full Amount Due  Disputes resolved in the merchant’s favor should be processed and paid through USAS using the Object Code you would normally use for the specified purchase. Disputes Resolved in Entity’s Favor  Dispute message on statement will say that the dispute has been resolved.  Chargeback (credit) for the disputed transaction will be placed on the account with the description: “Credit Miscellaneous/Dispute Credit”

19. 19 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Minimize Your Entity’s Dispute Risk  File Disputes Timely  Maintain sufficient documentation on transactions to support your dispute  Avoid Card Sharing – It forfeits your dispute rights!  Minimize Use of Department Cards  There are LIMITED Dispute Rights available for Department Cards. Only the following non-fraud related dispute reasons are actionable on Department Cards: - Transaction Amount Differs -Duplicate Processing -Canceled Recurring Transaction -Credit Posted as Debit - Cardholder Dispute-Defective Merchandise/Not as Described -Cardholder Dispute-Not Elsewhere Classified (US Only) -Non-receipt of Merchandise Services Not Rendered -Credit Not Processed

20. Employee Abuse 2006 State of Texas Credit Card User’s Conference

21. 21 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Types of Employee Abuse Covered By MasterCoverage IBA  Charges on card that were reimbursed to the employee, which were not remitted by the employee to JPMC. ―This eventually results in CREDIT LOSSES  Charges on card that were reimbursed to the employee that did not directly or indirectly benefit the entity. CBA – PCARD – CLIBA  Charges on card that did not directly or indirectly benefit the entity. ―Personal Charges

22. 22 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Employee Abuse: State of Texas Trend  Credit Losses which have impacted the State of Texas rebate have occurred only on IBA & CLIBA accounts to date.  There have been no MasterCoverage claims filed to indemnify the State of Texas for Credit Losses or Other Employee Abuse  Claims for credit losses are only recoverable to the extent that the cardholder was reimbursed for the transactions.

23. 23 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. MasterCoverage Liability Protection Program  Coverage afforded by MasterCard to indemnify entities for instances of Employee Abuse.  Maximum coverage of $100K per cardholder  For State of Texas CO-Ops that have elected this option, Cash advances are covered up to $300 /day or $1000 per claim.  Based on the type of liability that exists between JPMC and State of Texas  Requires Program Administrator action ―Adherence to strict claim criteria, misuse definitions and timelines ―Limited to certain activity up to 75 days before and 14 days after JPMC is notified of employee termination ―PA must complete claim documentation within defined timeframes ―PA can obtain forms from Customer Service or Relationship Manager

24. 24 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. MasterCoverage Requirements & Exclusions  Key Requirements  Employee must be terminated in order to access this coverage.  Card must be cancelled within two business days of the employee termination date  Key Exclusions  Charges made on cards or accounts issued to multiple employees rather than an individual, which cannot be traced back to the employee who incurred the charge (Department Cards).  Charges made by someone who is not an employee of the entity. This is not an exhaustive list of requirements & exclusions. The MasterCoverage Document should be reviewed for all requirements & exclusions and is located on the TBPC website http://www.tbpc.state.tx.us/cat_page/cat_946_a1_0306.html

25. 25 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Mitigating Employee Abuse Risk On IBAs:  Program Administrators should take a more active role in managing IBA accounts ―Many PAs are reluctant to become involved citing a “no liability” program not understanding that credit losses directly impact the State’s revenue. ―Misuse of a state issued charge card may violate section 39.01 of the Penal Code ―Implement and ensure that a Card Use Policy is signed by the cardholder and maintained on file for all active cardholders ―Ensure cardholders understand that payment is due in full by the 10 th of the following month, regardless of reimbursement schedules ―Cooperate with JPMC customer service and collections with providing information on cardholders that could assist with preventing a credit loss or recovering funds as a result of a credit loss.  Monitor JPMC delinquency reports and manage accounts nearing charge off, which would result in a credit loss  Review program credit losses ―Determine why the cardholder has charged off. ―Review expenses vs. Card activity: Was the cardholder reimbursed for the activity that ultimately caused the loss?

26. 26 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Mitigating Employee Abuse Risk On CBA – PCARD – CLIBA  Review transactions on a daily basis  Actively review card activity for charges of a personal nature ―Charges made on the weekend, in-home city charges, high-risk MCCs  Become familiar with the types of purchases for each division, group or location  IMMEDIATELY investigate cardholders that do not complete your transactions approval requirements in a timely manner ―Consider closing the card until required documentation is received or appropriate steps are taken.  Take a “linear” look at cardholder activity and investigate behavioral and spending pattern changes. ―A cardholder historically spends between $1000-$1500 per month and then all of sudden spends $5000 per month.

27. 27 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Know Your Program! Be aware of your program facts:  Know the cost savings associated with your program so that you are abreast of the value of the program  Know industry loss statistics so that you know where to look for risky activity  Know how much is spent in a spend category on card vs. non-card for your entity – extreme variances in these numbers may indicate a problem.  Know your coverage with MasterCard and seek recovery for losses where applicable  Document recommended program improvements and changes to management

28. Question & Answer

29. 29 © 2005 JPMorgan Chase and Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Session Contacts & Resources TBPC & State Auditor Websites  STMP Travel Program - http://www.tbpc.state.tx.us/travel/corpcharge.htmlhttp://www.tbpc.state.tx.us/travel/corpcharge.html  Procurement Program - http://www.tbpc.state.tx.us/cat_page/cat_946_a1_0306.htmlhttp://www.tbpc.state.tx.us/cat_page/cat_946_a1_0306.html  State Auditor’s Office - http://www.sao.state.tx.ushttp://www.sao.state.tx.us JPMC State of Texas Customer Service Team  Nicole Sirianni & Melissa Johnson  1-(888) 508-9758  Email: CCS-Public-Sector@Chase.com JPMC Relationship Management Team  Toinette Miller (972) 377-8132toinette.a.miller@jpmchase.comtoinette.a.miller@jpmchase.com  Laura Miles(972) 529-5455laura.s.miles@jpmchase.comlaura.s.miles@jpmchase.com  Audrey Flood (512) 246-9204 audrey.e.flood@jpmchase.comaudrey.e.flood@jpmchase.com